# Authorization issues

**URL:** <https://community.letsencrypt.org/t/authorization-issues/116615>\
**Category:** Help\
**Created:** [March 17, 2020, 8:04pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615 "2020-03-17T20:04:08Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![martinchako](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@martinchako](https://community.letsencrypt.org/u/martinchako)\
**Post date:** [March 17, 2020, 8:04pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/1 "2020-03-17T20:04:08Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:  
[quantumprofile.com](http://quantumprofile.com)

I ran this command:  
.\wacs.exe --target iissite --siteid 181

It produced this output:  
“type”: “urn:ietf:params:acme:error:unauthorized”,  
“detail”: “During secondary validation: Invalid response from [http://www.quantumprofile.com/.well-known/acme-challenge](http://www.quantumprofile.com/.well-known/acme-challenge)  
/eIlw2JFnhBTcGXpSzSD7RrhV5bdCzQt\_ZE8HV1DH8Es [198.38.83.28]: “Administrative Quarantine\</hea  
d\>\<table width=\“100%!\(MISSING)”\>

\<td bgcolor=#3300cc align=””,  
“status”: 403

My web server is (include version): IIS 10

The operating system my web server runs on is (include version): Windows 2016

I can login to a root shell on my machine (yes or no, or I don’t know): yes

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): 2.1.5

We experience issues with SSL validation and we are behind firewall where lots of IPs are blocked and I’m pretty sure that this is what is the issue here. Is there any way to provide me with the IPs currently used for validation? We need to check our logs why this IPs got blocked on the firewall and make sure that this won’t happen again.

Thank you!

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [March 17, 2020, 8:06pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/2 "2020-03-17T20:06:54Z")

</div>

Hi @martinchako

> [@martinchako](#):
>
> During secondary validation

Letsencrypt uses - new - multiple systems to validate your domain.

Read

> [@ACME v1/v2: Validating challenges from multiple network vantage points](https://community.letsencrypt.org/t/acme-v1-v2-validating-challenges-from-multiple-network-vantage-points/112253):
>
> O…

Your error: The Letsencrypt servers can connect your server. These additional servers can't.

So allow that if you want to use http validation.

---

<div class="post-metadata">

**Author:** ![martinchako](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@martinchako](https://community.letsencrypt.org/u/martinchako)\
**Post date:** [March 17, 2020, 8:31pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/3 "2020-03-17T20:31:56Z")

</div>

Hello,

Thanks for the quick response!

The error message looks like the one we have one our firewall when IP is blocked and for this reason I thought that IP used for validation can be blocked.

Just to make sure that I understand correctly. We need to make request form this form:

> **[Multiple Vantage Point Validation Exception Request](https://docs.google.com/forms/d/e/1FAIpQLSfaW8KUOulxuf14bb5qsy0p30N83diZNYIpPD7OMFgT084hQg/viewform?usp=send_form)**
>
> https://community.letsencrypt.org/t/acme-v1-v2-validating-challenges-from-multiple-network-vantage-points/112253

am I correct?

---

<div class="post-metadata">

**Author:** ![martinchako](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@martinchako](https://community.letsencrypt.org/u/martinchako)\
**Post date:** [March 17, 2020, 8:33pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/4 "2020-03-17T20:33:21Z")

</div>

Hello,

The error message looks like the one we have one our firewall when IP is blocked and for this reason I thought that IP used for validation can be blocked.

Do you mean that our IPs are blocked and we need to fill the form at:

> **[Multiple Vantage Point Validation Exception Request](https://docs.google.com/forms/d/e/1FAIpQLSfaW8KUOulxuf14bb5qsy0p30N83diZNYIpPD7OMFgT084hQg/viewform?usp=send_form)**
>
> https://community.letsencrypt.org/t/acme-v1-v2-validating-challenges-from-multiple-network-vantage-points/112253

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [March 17, 2020, 9:10pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/5 "2020-03-17T21:10:30Z")

</div>

> [@martinchako](#):
>
> “status”: 403

403 usually means "authentication required".

Not sure what this means, nor how to allow.  
But definitely, the problem is within your server and within your control.

> [@martinchako](#):
>
> Administrative Quarantine

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 17, 2020, 9:10pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/6 "2020-03-17T21:10:32Z")

</div>

> [@martinchako](#):
>
> am I correct?

no. exceptions will expire in June anyhow.

you need to allow all IPs or move to dns-01 validation.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [March 17, 2020, 9:15pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/7 "2020-03-17T21:15:22Z")

</div>

> [@martinchako](#):
>
> when IP is blocked

Don't block ip addresses. That's wrong if you want to use http validation.

---

<div class="post-metadata">

**Author:** ![martinchako](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@martinchako](https://community.letsencrypt.org/u/martinchako)\
**Post date:** [March 17, 2020, 9:24pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/8 "2020-03-17T21:24:56Z")

</div>

I agree with you but we have complex network and we need an IP to check what was causing the block so that we can fix it. I’m not talking about one server trying to make validation. We have lots of servers but since we cannot determine the IP of the server which makes the validation request or at least the ptr record of the IP so that we can find the ip in the list of the blocked IPs.

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 17, 2020, 9:43pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/9 "2020-03-17T21:43:38Z")

</div>

they will change without notice.

you should allow all or seriously think about switching to dns validation.

---

<div class="post-metadata">

**Author:** ![martinchako](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@martinchako](https://community.letsencrypt.org/u/martinchako)\
**Post date:** [March 17, 2020, 9:51pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/10 "2020-03-17T21:51:09Z")

</div>

Ok, let them change it. I need to see why the IP in question is blocked now so that when then change it we will not block it again.

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 17, 2020, 9:54pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/11 "2020-03-17T21:54:44Z")

</div>

well, currently it’s from AWS. but don’t count on this. it might validate from anywhere.

read here:

> **[Multi-Perspective Validation Improves Domain Validation Security - Let's...](https://letsencrypt.org/2020/02/19/multi-perspective-validation.html)**
>
> At Let’s Encrypt we’re always looking for ways to improve the security and integrity of the Web PKI. We’re proud to launch multi-perspective domain validation today because we believe it’s an important step forward for the domain validation process....

---

<div class="post-metadata">

**Author:** ![martinchako](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@martinchako](https://community.letsencrypt.org/u/martinchako)\
**Post date:** [March 17, 2020, 10:02pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/12 "2020-03-17T22:02:04Z")

</div>

I understand that. I need the IP. When I have the IP i will check our logs and see why that IP is blocked and when I see why this IP is blocked I will fix the issue. It’s simple but unfortunately we are going nowhere here…

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 17, 2020, 10:10pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/13 "2020-03-17T22:10:43Z")

</div>

nobody knows the IP. 😃

and who knows isn’t telling.

check if you can use `dns-01`, it will solve this problem.

---

<div class="post-metadata">

**Author:** ![martinchako](https://avatars.discourse-cdn.com/v4/letter/m/9de053/32.png) [@martinchako](https://community.letsencrypt.org/u/martinchako)\
**Post date:** [March 17, 2020, 10:12pm UTC](https://community.letsencrypt.org/t/authorization-issues/116615/14 "2020-03-17T22:12:55Z")

</div>

Great.

Please close this one.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 18, 2020, 1:56am UTC](https://community.letsencrypt.org/t/authorization-issues/116615/15 "2020-03-18T01:56:16Z")

</div>